Construire une stratégie cybersecurity robuste pour infrastructures critiques

Construire une stratégie cybersecurity robuste pour infrastructures critiques

Points clés :

• Protéger les infrastructures critiques reste une top priority, yet many organizations are still behind in cyber-defense readiness.
• COVID-19 a expand la définition de « critique » pour inclure secteurs comme manufacturing PPE, logistics, et food processing, prompting a reassessment of essential systems.
• Organizations must shift from reactive measures to a proactive cybersecurity posture, especially amid rising cyber-threats et increased remote operations.

La préoccupation publique over cyber-attacks on the electrical grid, dams, voting systems, et other federally designated infrastructure is growing. Yet, as Deloitte's Sean Peasley notes, most operational-technology (OT) firms still maintain only nascent cybersecurity programs.

Historiquement, « critical infrastructure » referred to public works tels que transportation et utilities. Over the past decades, the scope has broadened to encompass health care, energy, manufacturing, et more. Kieran Norton of Deloitte highlights that the pandemic has revealed even greater breadth, with PPE makers, logistics firms, pulp & paper, et meat-packing now recognized as essential.

While many OT organizations boast decades of experience in traditional risk management, cybersecurity is a relatively new focus. Andrew Howard, CEO of Kudelski Security, observes that OT security typically lags IT by 10–15 years.

According to IBM's X-Force Threat Intelligence Index 2020, attacks on industrial control systems surged in 2019, surpassing the combined volume of the previous three years. High-profile incidents include ransomware on Honda, Taiwan's energy utility, a U.S. natural-gas facility, Israel's water supply, et NTT's internal network breach.

Risk Assessment : An Ongoing Imperative

Without measurable risk, improvement stalls. Many critical infrastructure entities struggle to maintain an accurate asset inventory due to diverse, complex environments et a shortage of OT cybersecurity specialists.

Initial risk assessments should quantify threats, vulnerabilities, et potential consequences, focusing on shared passwords, unpatched systems, third-party hardware/software, et permissive firewalls. Such assessments can uncover extensive remediation lists, requiring prioritization based on severity et ease of fix.

Active network scanning can destabilize control systems, so a cautious, collaborative approach with operations is essential. Passive monitoring offers less intrusion mais may miss critical insights. The debate reflects a clash between IT's preference for active scanning et OT's risk-averse stance.

Remediation prioritization should weigh both risk severity et remediation effort. As Miklovic notes, boundary interfaces — protocol or physical — often represent the weakest link, with USB drives a common breach point. While quick fixes (e.g., sealing USB ports) are important, a balanced risk-based approach is more effective.

Joe Saunders of RunSafe recommends a 2×2 matrix to evaluate vulnerability likelihood versus impact severity, enabling a nuanced risk profile for each system.

New Risks in the New Normal

The pandemic has accelerated remote work, complicating security for production systems. Employees now use VPNs to modify production controls from home, a practice previously uncommon. Third-party vendors may also receive remote access, raising additional exposure.

Bandwidth, scaling, et deployment challenges often accompany increased remote connectivity. Simultaneously, traditional contingency plans that rely on physical presence et manual processes are now less reliable.

To adapt, critical infrastructure organizations should consider a holistic redesign of technology architecture, embedding security controls closer to assets.

Moving Toward Proactive Cybersecurity

The goal is to replace incremental, manual processes with a proactive posture that anticipates threats et adapts continuously.

Key components of a robust security policy include :

• Equipment & Devices — secure legacy industrial controllers, IoT sensors, gateways, et corporate laptops. Understanding device context is essential.
• Networks & Users — enforce strict access controls, deploy dynamic policy engines, et invest in breach detection.
• Data — classify et discover data to determine appropriate protection levels.
• Workflows & Supply Chain — secure processes, enforce contractor compliance, et protect against supply-chain attacks.
• Software Development — embed security throughout the SDLC to ensure resilient deployments.

Balancing prevention, detection, et response is crucial. Matt Selheimer of PAS Global recommends allocating 50 % of effort to prevention et 50 % to detection and recovery. Norton emphasizes that response capabilities are as vital as preventive controls.

Frameworks and Maturity Models

Organizations can align with established frameworks tels que ISO 27002, ISA/IEC 62443, et the Department of Defense's Cybersecurity Maturity Model Certification (CMMC). CMMC provides a five-tier maturity model, from basic hygiene (Level 1) to advanced optimization (Level 5). The model's requirement for third-party audits promotes objectivity et accountability.

CMMC Level	Focus	Key Practices
Level 1	Basic cyber hygiene (performed)	Selected practices documented where required
Level 2	Intermediate cyber hygiene (documented)	All practices documented; policies exist for all activities
Level 3	Good cyber hygiene (managed)	Cyber plan operationalized across all activities
Level 4	Proactive (reviewed)	All cyber activities reviewed, measured, and shared with management
Level 5	Advanced progressive (optimizing)	Standardized documentation across the organization

Automation and Embedded Security

Machine-learning-driven monitoring can automate routine tasks like breach detection. Embedded security on resource-constrained devices offers intrinsic protection et asset visibility.

However, premature automation without a solid policy can generate false positives. As Selheimer notes, fine-tuning firewall rules et SIEM correlation is essential to reduce noise.

Due to the unique landscape of critical infrastructure, off-the-shelf automation may require customization. Norton suggests isolating sensitive systems et applying orchestration to bridge automation gaps.

Ultimately, threats will evolve rapidly. Staying proactive means continuously adjusting the cyber-posture to reflect emerging risks et industry trends.

For more industry insights, register for IoT World's virtual event on August 11-13, featuring IoT, IA, 5G, et edge solutions across verticals. Register today.